AIKIDO-2026-137113

TL;DR

vortex-array deserializes arrays from serialized buffers using per-buffer padding, length, and alignment descriptors read from an embedded flatbuffer. These descriptors are trusted and used to slice the backing segment and to compute buffer alignment without bounds or range checks, so oversized lengths or too-large alignment exponents from malformed data trigger a panic. This path is reachable when decoding arrays from untrusted Vortex files or IPC streams. The fix bounds-checks buffer offsets and lengths before slicing and uses a fallible alignment-exponent conversion instead of a panicking one.